KR100603107B1 - Method for issuing the certificate contained the link information of one's credit information and Record media recorded the certificate issued by the above method - Google Patents

Abstract

The present invention relates to a method for issuing an accredited certificate including link information of credit information, and to a computer-readable recording medium on which an accredited certificate issued by the method is recorded. The accredited certificate for a predetermined user through a certification authority (CA) server is provided. In the process of issuing, the CA server retrieves and stores the credit information of the user in the credit bureau server, and includes the link information on the credit information of the user in the certificate issued to the user. If the user's credit information changes, update the user's credit information indicated by the link information included in the certificate, and link the credit information to the electronic signature transmitted along with the encrypted transaction contents exchanged between the parties in the e-commerce transaction. By using an accredited certificate containing information, you can obtain the other party's credit information during e-commerce transactions. In order to ensure the e-commerce transaction safety, the certification certificate introduced for the safety of electronic commerce should include the credit information link information indicating the location where the credit information of the authorized certificate holder evaluated by the reputable credit rating agency is stored. By knowing the credit information of the counterparties with reference to this link information, it is possible to promote safer transactions in electronic commerce.

Certificate, Credit Information, Public Key Infrastructure (PKI)

Description

Method for issuing the certificate contained the link information of one's credit information and Record media recorded the certificate issued by the above method}

1 is a schematic diagram of a conventional public key infrastructure (PKI) certificate certification system

2 is a flow chart showing a conventional accredited certificate issuance process

3 is a schematic diagram of a system for issuing a public key infrastructure (PKI) accredited certificate according to the present invention;

Figure 4 is a flow chart illustrating a process for issuing an accredited certificate containing link information of credit information according to the present invention.

<Explanation of symbols for the main parts of the drawings>

100: Certificate Authority (CA) Server 200: Registrar (RA) Server

300: directory server 400: user computer

410: public certificate 420: certificate management system

500: credit bureau server 600: credit information database

The present invention relates to a method for issuing an accredited certificate including link information of credit information and a computer-readable recording medium on which an accredited certificate issued by the method is recorded. It is related to the issuance technology of the accredited certificate introduced to secure the safety and reliability of electronic commerce, such as checking the identity and contents of transactions and the contents of transactions, and preventing the denial of transaction facts.

With the rapid development of information and communication technology, various electronic commerce activities using electronic documents in cyberspace, such as internet shopping, internet banking, internet auction, inter-company electronic transaction, and electronic payment, are now actively performed.

However, since e-commerce is a non-face-to-face transaction through a network rather than a direct face-to-face transaction, it is impossible to verify the identity and contents of a transaction or to forge or alter the contents of the transaction. There is.

In order to solve this problem, the electronic signature is sent and received using the digital signature which has the same effect as the seal in the actual offline transaction, so that the identity of the transaction party and the contents of the transaction are forged or altered, and the denial of the transaction fact is prevented. Solved the problem.

Digital signature certification (hereinafter referred to as "certified certification") refers to the act of verifying and verifying by a certification authority server with public authority and expertise that the digital signature verification key matches the digital signature generation key owned by a natural or legal person. For this purpose, the certification authority server issues and manages an electronic certificate (hereinafter referred to as a public certificate) containing information such as a signer and a digital signature verification key.

The accredited certification authority server is an institution that performs the accredited certification business by receiving the designation from the Ministry of Information and Communication under the Digital Signature Act, and has a digital signature key (digital signature generation key and digital signature verification key) certification management system. It is an organization that uses digital signatures to verify the identity of counterparties, prevent the forgery and alteration of transactions, and block denial of the facts of transactions.

Typically, digital signature technology uses a public key infrastructure (PKI) encryption algorithm. The private key used in the public key infrastructure encryption algorithm is the digital signature generation key for generating the digital signature, and the public key is the digital signature verification key for verifying the digital signature. Therefore, the safe operation of the digital signature technology depends on the safe operation of the digital signature generation key (private key) and the digital signature verification key (public key).

Public Key Infrastructure (PKI) is secure and secure by using a pair of public and private keys granted by trusted organizations for insecure public network users such as the Internet. It allows you to exchange data secretly. In public key infrastructure (PKI) encryption, both public and private keys are generated simultaneously by the CA using the same algorithm. The private key is given only to the person who requested it, and the public key is published as part of the digital certificate in a public directory accessible to everyone. Private keys are never shared with others or transmitted over the Internet.

When sending an electronic document, the sender obtains the recipient's public key from the public directory, encrypts the electronic document, and sends it to the recipient. At this time, the sender encrypts the electronic certificate using his private key and sends the encrypted electronic document together with the encrypted electronic document so that the sender of the electronic document can be identified as the sender. The recipient decrypts the encrypted electronic document sent from the sender using his private key, and obtains the sender's public key from the public directory to decrypt the encrypted electronic certificate.

The core function of public key infrastructure (PKI) authentication is that confidentiality and e-commerce documents exchanged in the process of e-commerce are made, so that the contents of e-commerce can be known only to the trading parties and not to third parties. And e-commerce activities such as integrity to avoid tampering, identity to verify the identity of a trading party so that they can be held accountable for the conduct of the transaction, and contracts between parties. It is possible to guarantee non-repudiation that proves that the e-commerce activity is not denied due to harm.

The public key infrastructure (PKI) technology described above is a conventional technology that is known and implemented in various ways prior to this application, so a detailed description thereof will be omitted.

1 is a schematic diagram of a conventional public key infrastructure (PKI) certificate issuance system.

As shown in the figure, a conventional public key infrastructure (PKI) certificate issuance system includes a certification authority (CA) server 100, a registration authority (RA) server 200, and a directory. A server (Directory Server) 300 and a user computer 400.

The certification authority (CA) server 100 is the most essential object constituting the public key infrastructure (PKI), and manages the management of the legitimacy of the certificate when issuing, registering, and inquiring a certificate. The CA server 100 is composed of a policy approving authority (PAA), a policy certification authority (PCA), and a certification authority (CA) according to its role and function. It has a general configuration, and all of them are referred to as certification authority servers.

The Policy Approving Authority (PAA) establishes authentication policies used throughout the public key infrastructure (PKI), audits the compliance status and adequacy of certification policies of subordinate organizations, and internal and external the public key infrastructure (PKI). It establishes and approves the policy for mutual authentication in the company, authenticates the public key of subordinate organizations, and manages certificates and certificate revocation lists (CRLs).

The Policy Certification Authority (PCA) establishes and verifies policies to be followed by users and certification authorities (CAs) in its own domain under the PAA. ) Authenticates the public key and manages certificates, certificate revocation lists, etc.

The certification authority (CA) is a lower layer of the policy certification authority (PCA), and issues or revokes the public key certificate of the user, delivers its public key and the public key of the superior authority, and registers the user. In accordance with the request of the institution (RA) server 200, it issues a public certificate, cross-certificates, and manages the public certificate and its owner information.

The CA is an entity that generates or revokes a certificate according to the authentication policy. All CAs generate their own key pairs and optionally generate keys of users.

The certificate is generated by digitally signing with a CA's private key. The certificate is issued to a certification authority, a user, a server, etc., and is issued to a certification authority to prove the legitimacy of a higher certification authority. Is issued to prove the identity or legitimacy of the user or server.

The domain refers to a logical grouping of CAs that implement common security policies or issue certificates for users in closely related namespaces.

Cross-Certificate is a certificate issued by one CA to another CA.

The Registrar (RA) server 200 is a user between the CA server 100 and the user computer 400 for users who are physically remote from the CA server 100. Performs a function to verify the identity of users in accordance with a request for issuance of an accredited certificate from, and if the identity is confirmed, after the electronic signature of the registrar (RA) server 200 is authorized to the certification authority (CA) server 100 Request issuance of a certificate. Then, the certification authority (CA) server 100 checks the electronic signature of the registrar (RA) server 200 and issues an authorized certificate for the corresponding user to return to the registrar (RA) server 200 or the user. Publish directly to

The directory server 300 stores a certificate, user related information, a mutual certificate, a certificate revocation list (CRL), etc. issued by the CA server 100, and stores a place for retrieval thereof. As a separate server is installed and operated or managed by the certification authority (CA) server 100 itself.

The user computer 400 stores the user's own certificate (410) issued by the certification authority (CA) server 100, and exists in the form of software to manage the user's own certificate (410) Management system 420.

In the certification certificate 410, a unique identification number (Serial Number) for the corresponding certification certificate, an algorithm identifier (Signature Algorithm ID) used to sign the certification certificate, and an issuer (certificate authority) name that signed and generated the certification certificate (Issuer) Name), Validity Time indicating the start time and end time the certificate can be used, Subject Name to receive the certificate, Subject Public Key Info, and Certification Policy Policy).

The above-mentioned Certification Policy includes the mechanism by which the CA server operates, the encryption algorithm and digital signature algorithm used, the minimum key size, the maximum validity of the certificate, the maximum duration of certificate revocation list renewal, and the certificate. Mechanisms for identifying the user's identity for publication.

The certificate management system 420 generates a private key and public key pair of the user, requests a public key certificate from a certification authority, receives a certificate, verifies an electronic signature, and obtains a public certificate of another user to check the state. It checks and provides its own certificate to other users.

The certificate management system 420 obtains the public key of the electronic document receiver from the directory server 300 when sending the electronic document for the electronic commerce activity, encrypts the electronic document and transmits the electronic document to the receiver. At this time, the certificate management system 420 encrypts the authorized certificate 410 of the user using a private key issued to the user and sends the digital signature with the encrypted electronic document (Digital Signature). )do.

On the other hand, the certificate management system 420 decrypts the encrypted electronic document transmitted from the transaction party during the e-commerce transaction using its private key, and the encrypted public certificate transmitted with the encrypted electronic document. Is verified by using the public key of the trading party that sent the electronic document.

The public key of the transaction party is preferably obtained by the certificate management system 420 from the directory server 300. Alternatively, the public key of the transaction party may be transmitted to the user from the transaction party with an encrypted electronic document. .

Therefore, through an electronic certificate issued by a credible certification authority that is sent with an electronic document (transaction details), it is possible to confirm the identity of the transaction party and whether or not to alter the contents of the transaction during electronic commerce such as electronic payment and electronic contract through the network, It will be possible to secure the safety and reliability of electronic commerce, such as preventing repudiation of transaction facts.

2 is a flowchart illustrating a conventional accredited certificate issuing process.

Looking at the process of issuing a conventional public certificate, a user first requests a public certificate issuance to a registrar (RA) server 200 using his user computer 400 (S110).

That is, when a user requests to issue an accredited certificate by accessing the registrar (RA) server 200 using his user computer 400, the registrar (RA) server 200 goes to the corresponding user computer 400. Graphical user interface (GUI) for inputting user information (name and social security number if individual, corporate name and business registration number if corporation) is provided, and when the user enters user information through this, the user computer 400 The certificate issuance request information is transmitted to the registrar (RA) server 200.

The registrar (RA) server 200 receiving the request for issuing an accredited certificate from the user computer 400 checks the identity of the corresponding user and checks the identity of the user to the certification authority (CA) server 100 for the corresponding user. Request issuance of an accredited certificate (S120).

That is, when the registrar (RA) server 200 receives the request for issuing the certificate from the user computer 400, the registration authority (RA) server 200 performs an identity inquiry from the user information included therein to determine whether the user is an individual or a corporation. In the case of identity inquiry, the registrar (RA) server 200 typically requests a real name verification system (not shown) to confirm the identity of a corresponding user, and receives an identity verification result. If, as a result of identity verification, identity verification is authenticated, the registrar (RA) server 200 transmits the certificate issuance request information for the user to the certification authority (CA) server 100, and identity verification is not authenticated. If not, stop issuing the accredited certificate.

At this time, the data including the authentication certificate issuance request information transmitted between the registrar (RA) server 200 and the certification authority (CA) server 100 is encrypted and transmitted in a public key infrastructure (PKI) manner. On the receiving side, it is preferable to decrypt the encrypted data. Since encryption and decryption techniques using a public key infrastructure (PKI) are conventional techniques that have been widely known and implemented before this application, a detailed description thereof will be omitted.

The certification authority (CA) server 100 receiving the request for issuing a certificate for a predetermined user from the registrar (RA) server 200 generates a certificate for the corresponding user and generates the certificate of the certificate (RA) server ( Issuing by transmitting to 200, or directly sent to the user computer 400 (S130).

In addition, the certification authority (CA) server 100 stores and stores the issued certificate and information about the same in the directory server 300 (S140).

The accredited certificate includes a unique identification number for the corresponding accredited certificate, a signature algorithm ID used to sign the accredited certificate, an issuer name signed and generated by the accredited certificate, and a accredited certificate. Includes a validity time that indicates the start and end time the certificate can be used, the Subject Name from which a public certificate is issued, the user's Subject Public Key Info, and a Certification Policy. It is.

When an authorized certificate for a predetermined user is issued from the certification authority (CA) server 100, the registrar (RA) server 200 transmits and issues an issued certificate issued to the user to the corresponding user computer 400. (S150).

In this way, the certificate is issued to the user, and then the user accesses the directory server 300 through his user computer 400 and inquires or verifies the certificate information transmitted to the user. It performs (S160).

However, although the conventional accredited certificate issued by the above process was issued by a credible certification authority and was able to guarantee a certain level of transaction safety during electronic commerce, the counterparty could not verify the credit information of the counterparty. Believe in the credit of the deal was forced to respond.

Therefore, the present inventors should include the link information on the credit information of the holder of the official certificate evaluated by the credible credit rating agency in the official certificate introduced for the transaction safety of electronic commerce, and the counterpart's credit information when verifying the official certificate. How to issue a certificate that includes link information of credit information that can achieve safer transaction in electronic commerce by referencing this link information and computer readable recording medium on which the certificate issued by this method is recorded I started to study about.

The present invention has been invented under the above-mentioned purpose, and the certification information introduced for the transaction safety of electronic commerce includes the link information on the credit information of the certificate holder, which has been evaluated by a credible credit rating agency, and verified the certificate. The implementation of the credit information of counterparties in the city can be done by referring to this link information, and the method of issuing a certificate including the link of the credit information to promote safer transactions in electronic commerce and the certificate issued by the method are recorded. It is an object of the present invention to provide a computer-readable recording medium.

Still another object of the present invention is to issue an accredited certificate including credit information link information that can guarantee the latestness of credit information by updating the user credit information indicated by the credit information link information included in the accredited certificate when the user's credit information changes. The present invention provides a computer-readable recording medium on which a method and an accredited certificate issued by the method are recorded.

According to an aspect of the present invention for achieving the above object, the present invention is the server of the CA in the process of issuing a certificate for a given user through a CA server (CA) server; Inquiries and stores the credit information of the user, and is issued by including the link information about the credit information of the user in the certificate issued to the user, and when the user's credit information changes, the link information included in the certificate is The credit information of the counterparties in the e-commerce transaction is renewed by updating the credit information of the instructing user and using a certificate which includes the link of the credit information in the e-signature transmitted together with the encrypted transaction contents exchanged between the parties in the e-commerce transaction. Characterized in that it is to know.                         

Therefore, in the accredited certificate introduced for the transaction safety of electronic commerce, the link information on the credit information of the accredited certificate holder evaluated by the credible credit rating agency is included. By implementing so that it can be known by referring to, it is possible to promote safer transactions in electronic commerce.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily understand and reproduce the present invention.

3 is a schematic diagram of a system for issuing a public key infrastructure (PKI) accredited certificate according to the present invention.

As shown in the figure, the public key infrastructure (PKI) certificate issuing system according to the present invention is a certification authority (CA) server (100), registration authority (RA: Registration Authority) server (200) and And a directory server 300, a user computer 400, a credit bureau server 500, and a credit information database 600.

The certification authority (CA) server 100 is the most essential object constituting the public key infrastructure (PKI), and manages the management of the legitimacy of the certificate when issuing, registering, and inquiring a certificate.

The certification authority (CA) server 100, when requesting issuance of a certification certificate for a predetermined user from the registrar (RA) server 200, the certification certificate including credit information link information indicating a location where the credit information of the user is stored. Generate and send it to the registrar (RA) server, or issue it by sending directly to the user computer (400). Then, the issued certificate and the information is stored in the directory server 300.

That is, in the public certificate generated and issued by the present invention, a unique identification number (Serial Number) for the corresponding public certificate, an algorithm identifier (Signature Algorithm ID) used to sign the public certificate, and an issuer who signed and generated the public certificate. (Issuer Name), Validity Time indicating the start time and end time that the accredited certificate can be used, Subject Name to receive the accredited certificate, and the user's public key information (Subject Public Key) Info), a certification policy, and credit information link information indicating a location where user credit information is stored.

At this time, the certification authority (CA) server 100 generates a public certificate including the link information of the credit information when the certification authority (CA) server 100 stores the user's credit information credit information database 600 If the user's credit information exists in the search, if present, it is preferable to generate an authorized certificate using file information including a directory in the credit information database 600 storing the user's credit information as the credit information link information. .

On the other hand, the certification authority (CA) server 100 when the certification authority (CA) server 100 is generated in the credit information database 600, the user's credit information is stored when generating a certificate containing the credit information link information If the user's credit information does not exist by searching, the certification authority (CA) server 100 queries the credit information of the user with the credit rating agency server 500 to retrieve the credit information of the user inquired It is preferable to generate an accredited certificate stored in the credit information database 600 and file information including a directory in the credit information database 600 storing the credit information of the user as the credit information link information.

Since the user's credit information is likely to change over time, it is desirable to periodically update the user's credit information referenced by the credit information link information included in the certificate issued to the user. Therefore, the CA server 100 periodically inquires whether the credit information of the users stored in the credit information database 600 has been changed, and the credit information of the users whose credit information has been changed. Received from the credit rating agency server 500 is preferably stored in the credit information database 600 to update the credit information.

On the other hand, the authentication certificate containing the link information of credit information issued to the user is transmitted along with the encrypted transaction details in the e-commerce transaction, the user, when verifying the authentication certificate containing the link information of the other party of the transaction sent to the user, The credit information of the user is read and viewed from a location where the credit information of the user is stored with reference to the credit information link information. Detailed description thereof will be described later.

The Registrar (RA) server 200 may be configured to be used by a user between the Certificate Authority (CA) server 100 and the user computer 400 for users who are physically remote from the Certificate Authority (CA) server 100. In accordance with the request for issuance of a certificate of public certification, it performs a function of verifying the identity of a corresponding user through a real name verification system (not shown in the drawing), and, if the identity is verified, requests the certificate authority (CA) server 100 to issue a certificate. do. Then, the certification authority (CA) server 100 issues an authorized certificate including credit information link information indicating a location where the credit information of the user is stored as described above.

The certification authority (CA) server 100 and the registration authority (RA) server 200 may be physically separated from a server that provides a single authorized certificate issuing service, but more preferably, physical, It is desirable to implement logically separate.

The directory server 300 stores a certificate, user related information, a mutual certificate, a certificate revocation list (CRL), etc. issued by the CA server 100, and stores a place for retrieval thereof. As a separate server is installed and operated or managed by the certification authority (CA) server 100 itself.

The user computer 400 stores the authentication certificate 410 including the link information of the user credit information issued by the CA server 100, and exists in the form of software so that the user's own certificate ( And a certificate management system 420 that manages 410.

The certificate 410 is a unique identification number (Serial Number) for the corresponding certificate, the algorithm identifier (Signature Algorithm ID) used to sign the certificate, the issuer (certificate name) name that signed and generated the certificate (Issuer Name) ), Validity Time indicating the start time and end time that the certificate can be used, Subject Name to receive the certificate, Subject Public Key Info, and Certification Policy ) And credit information link information indicating a location where user credit information is stored.

The certificate management system 420 generates a secret key and a public key pair of the user, requests a public key certificate from a certification authority server, receives a certificate, verifies an electronic signature, and obtains a public certificate of another user. It performs a function, such as verifying, providing other users with an accredited certificate containing their own credit information link information.

The certificate management system 420 obtains the public key of the electronic document receiver from the directory server 300 when sending the electronic document for the electronic commerce activity, encrypts the electronic document and transmits the electronic document to the receiver. At this time, the certificate management system 420 encrypts the authentication certificate 410 including the link information of the credit information of the user using a private key issued to the user together with the encrypted electronic document. Send digital signature by sending.

On the other hand, the certificate management system 420 decrypts the encrypted electronic document transmitted from the trading party using its private key during the e-commerce transaction, and of the corresponding transaction counterpart transmitted with the encrypted electronic document. The encrypted public certificate containing the link information of the credit information is decrypted and verified using the public key of the trading party that sent the electronic document.

The public key of the transaction party is preferably obtained by the certificate management system 420 from the directory server 300. Alternatively, the public key of the transaction party may be transmitted to the user from the transaction party with an encrypted electronic document. .

On the other hand, the certificate management system 420 refers to the credit information link information of the transaction counterpart included in the certificate, the location where the credit information is stored, that is, the credit information of the counterparty from the credit information database 600 It is preferable to further include a function for reading and displaying on the screen of the user computer 400 so that the user can know the credit information of the corresponding counterpart.

In addition, since the credit information of the user is likely to change over time, it is preferable that the credit information of the user referred to by the credit information link information included in the certificate issued to the user is periodically updated. Therefore, the CA server 100 periodically inquires whether the credit information of the users stored in the credit information database 600 has been changed to the credit bureau server 500, and the credits of the users whose credit information has been changed. It is preferable to update the credit information by receiving the information from the credit rating agency server 500 in the credit information database 600.

In addition, the certificate authority (CA) server 100 issuing so that the validation information for verifying whether the valid credit information in the credit information link information included in the relevant certificate when issuing the certificate, the certificate management system ( 420 may be used to decode the validation information so that the credit information of the counterparty may be justified.

For example, if the validation information is valid period of the credit information, if the certificate management system 420 compares the validity period of the credit information and the validity period of the accredited certificate, it is determined that the accredited certificate and the credit information are justified. Can be implemented.

Therefore, the identity of the parties and the contents of the transaction are forged or altered during electronic commerce such as electronic payments or electronic contracts through a network through an accredited certificate issued by a trusted certification authority server transmitted with an electronic document (transaction details). It is possible to secure the safety and reliability of electronic commerce, such as confirmation and prevention of non-repudiation of the facts of transactions, and to view the other party's credit information indicated by the credit information link information included in this certificate. By knowing your credit information, you can promote safer e-commerce.

The credit rating agency server 500 collects credit rating data of an individual or a corporation, converts a credit score from the collected credit rating data according to a predetermined statistical model, and credits an individual or a corporation according to the calculated credit score. Generate information. The technology related to the generation of credit information by the credit rating of the individual or corporation is a conventional technology that is already known and implemented variously before this application and is determined to be outside the scope of the present invention, so a detailed description thereof will be omitted. Shall be.

The credit information database 600 stores the credit information of the user inquired from the credit rating agency server 500 by the CA server 100. On the other hand, since the credit information of the user is likely to change over time, the CA server 100 periodically the credit information database 600 through the credit rating agency server 500 It is preferable to update the user's credit information stored in the credit information database 600 by inquiring the user's credit information stored in the credit information database 600.

Therefore, the credit information link information included in the public certificate issued to the user refers to the credit information database 600 which is periodically updated by the certificate management system 420 executed through the user computer 400. This ensures that you always have the latest credit information.

4 is a flowchart illustrating a process of issuing an accredited certificate including link information of credit information according to the present invention.

As shown in the figure, first, in step S210, the user computer 400 requests the issuance of a certificate from the registrar (RA) server 200.

That is, when a user requests to issue an accredited certificate by accessing the registrar (RA) server 200 using his user computer 400, the registrar (RA) server 200 goes to the corresponding user computer 400. Graphical user interface (GUI) for inputting user information (name and social security number if individual, corporate name and business registration number if corporation) is provided, and when the user enters user information through this, the user computer 400 The certificate issuance request information is transmitted to the registrar (RA) server 200.

Then, in step S220, the registrar (RA) server 200 receiving the request for issuing a certificate from the user computer 400 checks the identity of the user and checks the identity of the CA (100). Request a certificate issued by the user.

That is, when the registrar (RA) server 200 receives the request for issuing the certificate from the user computer 400, the registration authority (RA) server 200 performs an identity inquiry from the user information included therein to determine whether the user is an individual or a corporation. In the case of identity inquiry, the registrar (RA) server 200 typically requests a real name verification system (not shown) to confirm the identity of a corresponding user, and receives an identity verification result. If, as a result of identity verification, identity verification is authenticated, the registrar (RA) server 200 transmits the certificate issuance request information for the user to the certification authority (CA) server 100, and identity verification is not authenticated. If not, stop issuing the accredited certificate.

At this time, the data including the authentication certificate issuance request information transmitted between the registrar (RA) server 200 and the certification authority (CA) server 100 is encrypted and transmitted in a public key infrastructure (PKI) manner. On the receiving side, it is preferable to decrypt the encrypted data. Since encryption and decryption techniques using a public key infrastructure (PKI) are conventional techniques that have been widely known and implemented before this application, a detailed description thereof will be omitted.

Thereafter, in step S230, the certification authority (CA) server 100 that receives the request for issuing a certificate for a predetermined user from the registrar (RA) server 200 indicates that the credit information of the user is stored. Generates an accredited certificate including link information of credit information and transmits it to the registrar server 200 and issues it.

In step S240, the CA server 100 stores and stores the accredited certificate issued by the step and information on the same in the directory server 300.

That is, when the certification authority (CA) server 100 receives the request for issuance of a certificate for a predetermined user from the registrar (RA) server 200, the certification authority (CA) server 100 searches for the credit information database 600 to the corresponding user. Search if the credit information is stored, and if it exists, generate an accredited certificate including file information including the directory in the credit information database where the user's credit information is stored as the link to the credit information. The credit rating agency server 500 queries the credit information of the user, stores the credit information of the searched user in the credit information database 600, and stores the credit information of the user. Create an accredited certificate including file information including the directory in 600 as the link to the credit information.

The certification authority (CA) server 100 transmits and issues an accredited certificate including the credit information link information of the corresponding user to the registrar (RA) server 200 or directly to the user computer 400. It transmits and issues, and stores and stores the issued certificate and information on the directory server 300.

The accredited certificate includes a unique identification number for the corresponding accredited certificate, a signature algorithm ID used to sign the accredited certificate, an issuer name signed and generated by the accredited certificate, and a accredited certificate. Validity time indicating the start and end time the certificate is available, Subject Name to receive the public certificate, Subject Public Key Info, Authentication Policy and User Contains credit information link information that indicates where credit information is stored.

Next, in step S250, the registrar (RA) server 200 transmits the accredited certificate containing the credit information link information issued from the CA server 100 to the corresponding user computer 400. Issue a certificate.

In this way, the certificate is issued to the user, and in step S260, the user accesses the directory server 300 through his user computer 400 and includes the credit information link information of the counterpart transmitted to the user. When verifying the certified certificate, the transaction is stored by reading the credit information of the other party read from the credit information database 600, that is, the location storing the credit information of the user referred to by the credit information link information included therein You will know the other party's credit information.

The verification of the accredited certificate including the link information of the credit information through the step S260 or the reading of the credit information by referencing the same is performed by the certificate management system 420 existing in the form of software executed through the corresponding user computer 400. .

The certificate management system 420 generates a secret key and a public key pair of the user, requests a public key certificate from a certification authority server, receives a certificate, verifies an electronic signature, and obtains a public certificate of another user. It performs a function, such as verifying, providing other users with an accredited certificate containing their own credit information link information.

The certificate management system 420 obtains the public key of the electronic document receiver from the directory server 300 when sending the electronic document for the electronic commerce activity, encrypts the electronic document and transmits the electronic document to the receiver. At this time, the certificate management system 420 encrypts the authentication certificate 410 including the link information of the credit information of the user using a private key issued to the user together with the encrypted electronic document. Send digital signature by sending.

On the other hand, the certificate management system 420 decrypts the encrypted electronic document transmitted from the transaction party during the e-commerce transaction using its private key, and the corresponding transaction transmitted together with the encrypted electronic document. The encrypted public certificate containing the link information of the other party's credit information is decrypted and verified using the public key of the trading party that sent the electronic document.

The public key of the transaction party is preferably obtained by the certificate management system 420 from the directory server 300. Alternatively, the public key of the transaction party may be transmitted to the user from the transaction party with an encrypted electronic document. .

On the other hand, the certificate management system 420 refers to the credit information link information of the counterparties included in the certificate, the location where the credit information of the user is stored, that is, the credit information database 600 in which the credit information of the user is stored. By reading and displaying the counterpart's credit information from the user, the user can read the counterpart's credit information.

In addition, since the credit information of the user is likely to change over time, it is preferable that the credit information of the user referred to by the credit information link information included in the certificate issued to the user is periodically updated. That is, the CA server 100 periodically inquires whether the credit information of the users stored in the credit information database 600 has been changed, and the credit information of the users whose credit information has been changed. Received from the credit rating agency server 500 is preferably stored in the credit information database 600 to update the credit information.

In addition, the certificate authority (CA) server 100 issuing so that the validation information for verifying whether the valid credit information in the credit information link information included in the relevant certificate when issuing the certificate, the certificate management system ( 420 may be used to decode the validation information so that the credit information of the counterparty may be justified.

For example, if the validation information is valid period of the credit information, if the certificate management system 420 compares the validity period of the credit information and the validity period of the accredited certificate, it is determined that the accredited certificate and the credit information are justified. Done.

Therefore, through the electronic certificate (e.g. transaction details) issued by a trusted certification authority server, the identity of the trading party and the contents of the transaction are forged or altered during electronic transactions such as electronic payments or electronic contracts through the network. In addition, it is possible to secure the safety and reliability of electronic commerce such as non-repudiation of the facts of transactions, and to view the other party's credit information indicated by the credit information link information included in this certificate. By knowing the information, you can promote safer e-commerce.

Therefore, it is possible to achieve the purpose of the method for issuing an accredited certificate including the link information of credit information according to the present invention and the computer-readable recording medium on which the accredited certificate issued by this method is recorded. .

The method of issuing an accredited certificate including link information of credit information according to the present invention as described above, and the computer-readable recording medium on which the accredited certificate issued by this method is recorded is included in the accredited certificate introduced for the transaction safety of electronic commerce. Make sure to include the link to the credit information indicating the location where the credit information of the accredited certificate holders evaluated by a reputable credit rating agency is stored, and to realize the counterpart's credit information by referring to this link information when verifying the accredited certificate. Therefore, it has a useful effect to promote safer transactions in electronic commerce.

Although the present invention has been described with reference to the accompanying drawings, it will be apparent to those skilled in the art that various modifications may be made therein without departing from the scope of the invention, which is covered by the following claims.

Claims (11)

A first step of the user computer requesting issuance of a public certificate from a registrar server; The second step that the registrar (RA) server receiving the request for issuing the public certificate according to the first step confirms the identity of the user and requests issuance of the public certificate for the user to the CA when the identity is verified. Wow; The certification authority (CA) server, which has received the request for issuing the accredited certificate according to the second step, generates an accredited certificate including link information of the credit information indicating a location where the credit information of the user is stored, and the registrar (RA). Transmitting and issuing to the server; A fourth step of storing, by the CA server, the official certificate issued by the third step and information on the same in a directory server; A fifth step of the registrar (RA) server issuing an accredited certificate including the credit information link information issued from the CA server to a corresponding user computer to issue an accredited certificate; The method of issuing an accredited certificate including link information of credit information, characterized in that it comprises. The method of claim 1, When generating the accredited certificate including the link information of the credit information, the certification authority (CA) server searches for the existence of the credit information of the corresponding user in the credit information database, and if there exists, the credit information database storing the credit information of the corresponding user. Method for issuing an accredited certificate including link information of the credit information, characterized in that to generate an accredited certificate using the file information including the directory in the credit information link information. The method of claim 2, When generating the accredited certificate including the link information of the credit information, the CA server checks whether the credit information of the user exists in the credit information database, and if not, the CA server evaluates the credit. Inquiry of the credit information of the user with the institution server stores the credit information of the relevant user in the credit information database, and file information including a directory in the credit information database that stores the credit information of the user. Method for issuing an accredited certificate including link information of credit information, characterized in that to generate an accredited certificate as link information. The method of claim 3, wherein The method of issuing an accredited certificate including the link information of the credit information is as follows: When the user computer verifies the authentication certificate including the credit information link information of the transaction counterpart sent to the user, the credit information of the user is read from the location where the credit information of the user is stored with reference to the credit information link information. A method for issuing an accredited certificate including link information of credit information, characterized by displaying a screen. The method of claim 4, wherein The method of issuing an accredited certificate including the link information of the credit information is as follows: The certification authority (CA) server periodically inquires whether the credit information of users stored in the credit information database has been changed to the credit rating agency server, and receives the credit information of users whose credit information has been changed from the credit rating agency server. And storing the credit information in the credit information database to update the credit information. The method of claim 4, wherein The certification authority (CA) server issues the validation information for verifying whether the credit information is valid in the link of the credit information included in the relevant certificate when issuing the certificate, and decrypts the validation information when the credit information is read. Issuing method of accredited certificate including link information of credit information, characterized in that it checks whether the other party's credit information is valid. The method of claim 6, And the validity verification information is valid period of the credit information and compares the validity period of the credit information and the validity period of the accredited certificate with each other. The method of claim 4, wherein Method of issuing an accredited certificate including link information of credit information, characterized in that the data transmitted between the registrar (RA) server and the CA server is encrypted and transmitted in a public key infrastructure (PKI) method. The method of claim 4, wherein When verifying the authentication certificate sent from the counterparty, the encrypted electronic document transmitted from the counterparty is decrypted using its own private key, and the counterpart's credit information link information transmitted along with the encrypted electronic document. Method for issuing an accredited certificate including link information of the credit information, characterized in that the decrypted by using the public key of the transaction party that sent the electronic document encrypted encrypted containing the electronic certificate. The method of claim 9, The public key of the transaction party (Public Key) is a method for issuing an accredited certificate, including credit information link information, characterized in that obtained from the directory server. A computer-readable recording medium having recorded therein a user certificate information link information issued by the method for issuing a certificate containing the credit information link information according to claim 1.

Images